A. Field of the Invention
This invention relates generally to systems that provide mobile Internet Protocol (IP) networking, wherein a mobile communications device such as a portable laptop computer or personal digital assistant may communicate with a host computer on an IP network. More particularly, the invention relates to the architecture and arrangement of communications devices functioning as home agents and foreign agents that are used in such a system.
B. Description of Related Art
Public packet switched networks can be used to carry traffic to and from a mobile communications device, such as a laptop computer or personal digital assistant equipped with a cellular telephone modem. The basic architecture of mobile IP data networking is known in the art and described in several publications, including the Request for Comments document RFC 2002 (1996) and in the textbook of Charles E. Perkins, Mobile IP Design Principles and Practices, Addison-Wesley Wireless Communications Series (1998), both of which are fully incorporated by reference herein. Persons skilled in the art of mobile IP data networking are familiar with the contents of both of these documents and the devices used to implement mobile IP data networking in practice.
Basically, and with reference to FIG. 1, in Mobile IP communication, a wireless mobile node 10 communicates with a target host 12 on an IP network 14 by means of two devices, a xe2x80x9cforeign agentxe2x80x9d 16 and a xe2x80x9chome agentxe2x80x9d 18. Typically, foreign agent functionality is incorporated into a router or network access server chassis located on a mobile node""s visited network 20. A radio access network linking the mobile node to the foreign agent 16 is not shown for purposes of simplicity in the present discussion. The foreign agent 16 provides routing services for the mobile node while it is registered with the home agent 18. The foreign agent 16 de-tunnels and delivers datagrams to the mobile node 10 that were tunneled by the mobile node""s home agent 18. In the present specification, the term xe2x80x9ctunnelingxe2x80x9d refers to packet re-addressing, such as performed by the home agent.
The traffic exchanged between the foreign agent 16 and the home agent 18 includes control traffic 22, e.g., registration request and registration reply messages and session control messages, and data traffic 24. The control traffic 22 terminates at the home agent. The data traffic 24 is routed from the mobile node""s home network 26 to a second network 14 for delivery to the target host. The target host could be connected to the home network by any arbitrary number of intermediate IP networks, or could be on the mobile node""s home network 26.
The home agent 18 is typically implemented in a router on a mobile node""s home network 26. The home agent maintains current location information for the mobile node, through a variety of possible mechanisms, such as described in the patent application of Richard J. Dynarski, et al., xe2x80x9cDynamic Allocation of Wireless"" Mobile Nodes Over an Internet Protocol (IP) Networkxe2x80x9d, Ser. No. 09/233,381, which is incorporated by reference herein. When one or more home agents are handling calls for multiple mobile nodes simultaneously, the home agent(s) are providing, in essence, a service analogous to virtual private network services. Each mobile node is typically associated with a separate home network and the routing path from that home network, through the home agent, to the foreign agent and mobile node is like a virtual private network for the mobile node.
Thus, from the above discussion, it can be seen that the home agent performs two separate and distinct tasks for the foreign agent and mobile node. First, the home agent 18 must perform an authentication and registration process to determine whether the mobile node is authorized to access the home network 26. This may involve checking the identification of the mobile node (such as, through use of the mobile node""s unique serial number or manufacturing number), password authentication, and possibly checking that the mobile node""s account is current and paid in full. The home agent registration and authentication functions may be performed in conjunction with, or with the assistance of, a second device, such as an authentication, authorization and accounting server such as a RADIUS server. See the patent application of Yingchun Xu, Ser. No. 08/887,313 filed Jul. 3, 1997 for further details.
Second, the home agent 18 has to tunnel data from the target host to the foreign agent, and provide tunneling services in the reverse direction, i.e., provide packet re-addressing for traffic from the foreign agent to the host 12. To coordinate tunneling in the reverse direction, the home agent provides a forwarding xe2x80x9ccare/ofxe2x80x9d address to the foreign agent to tell the foreign agent 16 where to tunnel traffic from the mobile node so that it can be sent to the host. This forwarding address is typically contained in a registration reply message sent to the foreign agent notifying the foreign agent that the mobile node is authenticated to communicate in the home network. In the prior art, the home agent is also the device that receives the tunneled traffic from the foreign agent for routing onto the home network, and therefore the forwarding address is the home agent""s IP address.
The foreign agent also has to perform two distinct tasks for the mobile node, similar to that of the home agent. First, the foreign agent has to handle the registration and session control aspects for the mobile node, including sending registration request messages to the home agent and processing a registration reply message. Second, the foreign agent has tunneling responsibilities for forwarding data packets to the home agent for ultimate distribution to the destination, and de-tunneling data from the home agent and forwarding the data to the mobile node.
The known prior art for providing mobile IP networking services has embraced the concept of a single home agent, in a single chassis, for a given network. However, some larger scale providers of Mobile IP networking services may require multiple home agents on their networks in order to meet demand for mobile IP network services for a large distributed customer base. One possible approach to meeting the expected demand for home agent services is to provide multiple home agents, each home agent embodied in a separate chassis or device. Another approach is to provide a single home agent, but design the home agent such that it has an internal architecture to support multiple networks (e.g., multiple virtual private networks). This latter approach is not considered very attractive, in that management of the home agent would be cumbersome. Furthermore, the home agent would not be particularly fault tolerant, in that any mechanical or software problem in the home agent would potentially affect a large number of virtual private networks. In all the known prior art, the individual devices configured as home agents have implemented both home agent functions within the same device, i.e., registration functions and tunneling/routing functions as described above. Similarly the prior art has embraced the concept of performing both the registration and tunneling responsibilities for a foreign agent in a single device, e.g., network access server.
The present invention represents an improvement to the above approaches contemplated by the prior art. The present invention contemplates distributing the home agent functionality across multiple devices, with one device devoted to handing the registration and authentication functions, and another device devoted to the routing and tunneling functions of a home agent. The present inventors have appreciated that the: former functions, i.e., registration and authentication, are not particularly computationally intensive, and that a single general purpose computing device can handle a very large number of simultaneous registration and authentication transactions without any undue latency, management, or other problems, either alone or in concert with a RADIUS or Authorization, Authentication, and Accounting (AAA) server. On the other hand, the routing and inverse tunneling functions of a home agent are more CPU-intensive and better suited to more robust devices designed for such purposes, such as switches and routers. Thus, the present distributed home agent design of the present invention overcomes the scaling and management problems presented by prior art approaches and represents a simple, cost effective, and easily managed solution for providing mobile IP network services, particularly for large scale providers of such services.
In another related aspect of the invention, the functionality of a single foreign agent is distributed across multiple devices. For example, the registration and session control functions of a foreign agent are assigned to a first device, referred to herein as a xe2x80x9cforeign registration agentxe2x80x9d, such as a general purpose computer or network access server on the visited network. The tunneling functions of the foreign agent are assigned to one or more different devices, referred to herein as a xe2x80x9cforeign tunneling agent.xe2x80x9d
In a system which implements both distributed home agents and distributed foreign agents, the foreign registration agent would exchange registration and session control messages with the home registration agent. The tunneling of data traffic between the mobile node and the host system would occur between the home tunneling agent and the foreign tunneling agent.
Thus, in a first aspect, the present invention is an improvement to a system that provides mobile Internet Protocol networking for a mobile node via a foreign agent and a home agent. The improvement comprises implementing the home agent in two separate entities or devices. These two separate entities comprise (1) a home registration agent handling registration requests for the mobile node, and (2) a home tunneling agent receiving traffic from the mobile node via the foreign agent and redirecting the traffic to a destination for the traffic.
In a preferred embodiment, the home registration agent generates a registration reply message in response to a registration request message associated with the mobile node. The home registration agent sends the registration reply message to the foreign agent. The registration reply message contains an address associated with the home tunneling agent, such as an IP address of the home tunneling agent, whereby the foreign agent tunnels the traffic from the mobile node to the home tunneling agent for transmission to the destination for the traffic. An extension to the mobile IP protocol can be used as a means for including the home tunneling agent""s network address in the registration reply message.
In another aspect of the invention, a mobile Internet Protocol service provider system provides access to a network for a mobile node and enables the mobile node to communicate with a host on the network. The system-comprises a first communications device comprising a home registration agent responsive to a registration request message associated with the mobile node. The system further includes a second communications device, different from the first communications device, comprising a home tunneling agent associated with the home registration agent, the home tunneling agent receiving traffic from the mobile node and redirecting the traffic to the network. In a representative embodiment, the system is operated by a wireless communications service provider, and typically a wireless communications service provider that is serving a large number of wireless customers and therefore must provide for a high number of mobile nodes simultaneously. As noted previously, the specific communication device that is used to implement the home registration agent and the home tunneling agent is not particularly important, but will be selected in view of the typical processing requirements of the home tunneling agents and the home registration agents. In a preferred embodiment, the home tunneling agent comprises a router.
In another aspect of the invention, a machine is provided for authenticating a mobile node for network access. The machine implements just the registration part of a home agent function, with the tunneling part of the home agent function being taken up by a separate device such as a router. The machine, which may be implemented as a general purpose computer or other suitable device, includes a central processing unit, an interface to the network, and a machine readable storage medium comprising a set of instruction for processing registration request messages associated with the mobile node and responsively generating registration reply messages. The registration reply message contains a field containing a network address for a home tunneling agent. The network address of the home tunneling agent is different from a network address assigned to the machine, because the home tunneling agent function is being performed in the separate device.
In yet another aspect, a method is provided for authenticating a mobile node for network access. In accordance with the method, a registration request message is generated and sent from a foreign agent to a home registration agent. The registration request message contains information used to determine whether said mobile node is authorized to access a network, such as the mobile device""s unique International Mobile Subscriber Identity (IMSI) number and/or its Electronic Serial Number (ESN). The home registration agent then determines from the information in the registration request message whether the mobile node is permitted to access the network. This step may be performed with the assistance of a authorization, authentication and accounting server, e.g., a RADIUS server. The home registration agent then generates a registration reply message and sends the registration ;reply message from the home registration agent to the foreign agent.
If the step of determining results in a positive response, i.e., that the mobile device is authenticated or registered to use the network, the home registration includes in the registration reply message a network address of a home tunneling agent. The home tunneling agent is adapted to receive data traffic from the mobile node and direct the traffic onto the network. The foreign agent forwards data traffic from the mobile node to the home tunneling agent for transmission to the host or destination. The home registration agent and the home tunneling agent are preferably implemented in two separate communications devices. Similarly, the foreign agent functionality may be split up into two separate devices, one functioning as a foreign tunneling agent and another device functioning as a foreign registration agent. The foreign and home registration agents exchange the registration and session control messages, while the tunneling activity is handled by foreign and home tunneling agents.
These and still other features of the invention will be more apparent from the following detailed description of presently preferred and alternative embodiments of the invention.